Disección de amenazas en entornos de nube
•Download as PPTX, PDF•
0 likes•122 views
Esta presentación describe la naturaleza de las ciberamenazas modernas y cómo afectan la transición de la empresa a la infraestructura de la nube. Más específicamente, las suposiciones sobre la seguridad de la infraestructura en la nube que serán desafiadas y reexaminadas desde la perspectiva de un atacante, y se explorarán los puntos débiles de la nube. Esta presentación debe dar una perspectiva a las organizaciones con respecto a algunos de los puntos clave de debilidad en su nube, y qué se puede hacer para mitigar las amenazas que apuntan a estas debilidades en el futuro.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Disección de amenazas en entornos de nube
Similar to Disección de amenazas en entornos de nube (20)
More from Cristian Garcia G.
More from Cristian Garcia G. (20)
Recently uploaded
Recently uploaded (20)
Disección de amenazas en entornos de nube
- 1. Clouds Ahead: Dissecting Threats in Cloud Enviroments Forrest Williams – Red Team Engineer
- 2. Agenda • Red Teaming? • Attack Walkthrough • Post Mortem • Takeaways
- 3. Red Team Provides adversarial simulation services and allows customers to test their organization’s ability to detect and respond to targeted attacks
- 4. Steal Intellectual Property Steal Customer Data – PII, PCI, HIPAA Tarnish Reputation Steal Money Stepping Stone
- 10. Lateral Movement
- 11. Moving to the Cloud
- 12. Recap #1 Used phishing to gain initial foothold in the network 1 Performed internal reconnaissance2 Used local account to move laterally and compromise IT machines 3 Stolen domain admin credentials and compromise DevOps workstation 4 Used SSH keys from DevOps workstation to pivot to the AWS environment 5
- 13. Attacker C2 Server Developer Workstation
- 14. Cloud (In)Security If your security sucks now, you will be pleasantly surprised by the lack of change when you move to the cloud. — CHRIS HOFF
- 17. Ubuntu@ip-10-0-3-141: ~$ curl http://169.254.169.254/latest/meta-data/; echo ami – id ami – launch – index ami – manifest – path block – device – mapping/ hostname iam/ instance – action instance – id instance – type local – hostname local – ipv4 mac metrics/ network/ placement/ profile public – hostname public – ipv4 public – keys / reservation – id security – groups services
- 18. ProxyChains – 3.1 (http://proxychains.sf.net) { “Code” : “Success: , “LastUpdated” : “2017-04-04T17:16:19Z” , “Type” : “AWS – HMAC” “AccessKeyId” : “AXXXXXXXXXXXXXA” , “SecretAccessKey” : “GyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXOV” , “Token” : “FQoDi…………………………………………………………………………………=“, “Expiration” : “2017-04-04T23:44:14Z” } aws.json (END)
- 19. Cloud Takeover
- 21. Attack Walkthrough s Recap #2 Went from a single user clicking a phishing email…
- 22. Attack Walkthrough s …to complete takeover of the entire company.
- 26. • Allowing Local Admin on Workstations • Irreversible First • Unmanaged SSH Keys • Not Removing (and Revoking!) Unused Privilages • Not Taking “Least Privileged” Approach – API Keys
- 27. s Questions?
- 28. Thank You
Editor's Notes
- throughout the next few days, you will hear a lot about privileges , why they are so important, and how CyberArk can help you protect them in your organization. surprisingly, I'm also here to talk to you about privileges But I’m going to give you the other side , the Attacker side Intro myself
- Agenda… Red-team – what is a red-team ,and why you should be doing it on a regular basis Attack walkthrough – ending with us taking over the customer entire on premise and cloud infrastructure mortem analysis of the attack Finally , we will see what are the key takeaways you should be taking back to your own organization
- Ask 10 people about Red-Teaming –get 10 different answers The idea is to test your organization security posture against persistence attacker who react to your blue team actions and customized their attack based on YOUR organization existing defensive counter measure How do you show ROI in the new shiny blinking box Help identify path to your crown jewel Red-team is Goals oriented , predefined crown Jewels
- Operation Aurora against at least 30 major tech- 2009 PII -OPM (OFFICE of Personnel Management) 2015 25 M PII (2 hacks) Reputation - Hacking Team 2015 Swift Hack $81 Million 2016 Stepping stones - Target 2013
- Walkthrough of a real a Red-team engagement we did for one of our customer , a big technology company , in order to protect the innocents lets call this customer ACME - for the few of you who are not familiar with the reference - Road Runner/Wile E. Coyote cartoon , ACME was the company that created products that failed or backfire at the worst possible times. ACME just migrated most of their infrastructure to AWS :SaaS , customer-,source code, Crown Jewels This was two weeks engagement AND this wasnt an Assumed breach type of engagement ,which we need to start from outside
- since hackers are lazy surprisingly we decided to start with phishing When we do phishing engagement we collect information on the target company when we look at the targets , this is the point when the sales people in the crowd please cover you ears , we like to start with sale folks , why , because sales will click on anything .. Believe me if a sales person is getting an email from his customers with 1 million dollar purchase order he will click on what ever we send him.. In this case though ,the lucky winner was John from HR
- Our phishing email looked something like this . We bypassed their spam protection systems And within the first hour of engagement we had a shell , a foothold in the network.
- We have initial foothold in the network through the compromised HR machine , the first thing we did is internal reconnaissance, we collect information from active directory trying to map the organization internal network layout ,group memberships , users active sessions ,and permission mapping . We dumped the credentials from John’s computer and found the credentials for the user Frank . Frank seems to be an IT guy with had access to several other workstations in the network including local admin on his own machine. Our next goal would be compromised Frank’s machine
- We now had everything we need to start pivoting within the network.
- We stole Frank’s credentials and used them to request Kerberos ticket , we than use our newly acquired token to connect to Franks machine using WMI and inject our malicious payload into memory. We ended up with a second remote shell ,we compromised Franks machine . Once again , dumping the memory on his machine we ended with new set of credentials – this time it was domain admin. So we did what every hacker does after gaining domain admin – started celebrating it took us 2 days to achieve full network takeover….or so we thought… we started poking around the network for our crown jewels we were after and realize domain admin are great but they didn’t get us closer to the crown jewels we were after . If this was a traditional penetration testing we would have been done by now, but since we focused on adversary simulation they thing that matter are the crown jewels . In the old world getting domain admin is a game over , today , the keys to the kingdom are in the cloud , and DevOps rules all . And Puppet ,chef ,ansamble are the new domain controllers
- So we change our approach and set a new goal , compromised the DevOps team. We used the domain admin credentials to generate a new Kerberos tickets and compromised one of the developers workstation . Once we gained access to the developer workstation we found out he was running putty , a very common remote connection tool. We quickly extracted any saved sessions from registry and found a saved session pointing to an SSH private key used to access single AWS server Of course we stole that key and used it to SSH into that AWS server – we are in the clouds !
- Let’s recap for moment First we used phishing … We than preformed active Reconnaissance
- Let’s stop for a second and talk about clouds
- This is how it would look like: An IAM role with certine permissions which can later be assign the machine in order to delegate certain action ( e.g. access to S3 bucket)
- Amazon like other cloud providers supports IAM roles which are AWS identities with permission policies that determine what the identity can and cannot do in AWS.
- They are accessible over special URL unique to each cloud providers
- Back to our story . We just successfully pivoted from the on premise infrastructure to a single EC2 server …
- We have ssh access to that server as a normal user , we create a new AWS account under the Red-team control – you can see it’s empty at the moment On the EC2 server we make a request to Amazon metadata URL and specifically the IAM directory , and BAM we IAM role key It seems ACME didn’t limit the IAM role to just S3 access , the IAM key had full control over their entire ACME AWS environment. We politely proceed to make copies of every single server containing customer data , source code , financial records end so on , and attached those copies to our own AWS account.
- Let’s recap for moment First we used phishing … We than preformed active Reconnaissance